/*******************************************************************************
*
*  (C) COPYRIGHT AUTHORS, 2017
*
*  TITLE:       PATTERNS.H
*
*  VERSION:     1.00
*
*  DATE:        21 Apr 2017
*
*  Search patterns and patches header file.
*
* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF
* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED
* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
* PARTICULAR PURPOSE.
*
*******************************************************************************/

#pragma once

//
// pd - patch data
// pt - patch lookup pattern
//

// Patch data for SeValidateImageData STATUS_SUCCESS
unsigned char pdSeValidateImageData[] = { 0x0, 0x0, 0x0, 0x0 };

//mov eax, STATUS_INVALID_IMAGE_HASH
unsigned char ptSeValidateImageData_7601[] = { 0xB8, 0x28, 0x04, 0x00, 0xC0, 0xE9 };
unsigned char ptSeValidateImageData_9200[] = { 0xCC, 0x90, 0x90, 0xB8, 0x28, 0x04, 0x00, 0xC0 };
unsigned char ptSeValidateImageData_9600_15063[] = { 0xB8, 0x28, 0x04, 0x00, 0xC0 };

#define ptSkipBytesSeValidateImageData_7601             1
#define ptSkipBytesSeValidateImageData_9200             4
#define ptSkipBytesSeValidateImageData_9600_15063       1

//always in INIT

//Patch data for CcInitializeBcbProfiler ( return TRUE; )
unsigned char pdCcInitializeBcbProfiler[] = { 0xB0, 0x01, 0xC3 };

//search pattern for Windows 7
unsigned char ptCcInitializeBcbProfiler_7601[] = {
    0x44, 0x89, 0x44, 0x24, 0x18, 0x89, 0x54, 0x24,
    0x10, 0x89, 0x4C, 0x24, 0x08, 0x53, 0x55, 0x56
};

// always in INIT
//Patch data for KeInitAmd64SpecificState (return TRUE; )
unsigned char pdKeInitAmd64SpecificState[] = { 0xEB };

//search pattern for Windows 10 10.0.10563.0
unsigned char ptKeInitAmd64SpecificState_15063[] = { 0x0B, 0xD0, 0x8B, 0xCA, 0xF7, 0xD9 };

#define ptSubBytesKeInitAmd64SpecificState_15063	16

//Always in PAGE

//Patch date for SepInitializeCodeIntegrity
unsigned char pdSepInitializeCodeIntegrity[] = { 0x31, 0xC9 };

//mov ecx, edi
//call
unsigned char ptSepInitializeCodeIntegrity_7601[] = { 0x8B, 0xCF, 0xE8 };

//mov ecx, edi
//mov rbx,
unsigned char ptSepInitializeCodeIntegrity_9200_14393[] = { 0x8B, 0xCF, 0x48 };

//mov ecx, esi
//mov rbx,
unsigned char ptSepInitializeCodeIntegrity_15063[] = { 0x8B, 0xCE, 0x48 };

//xor eax, eax 
//retn
unsigned char pdImgpValidateImageHash[] = { 0x33, 0xC0, 0xC3 };


//
// Winload.EXE/Winload.EFI
//
unsigned char ptImgpValidateImageHash_7601[] = {
    0x48, 0x89, 0x5C, 0x24, 0x08, 0x48, 0x89, 0x6C, 0x24, 0x10, 0x48, 0x89, 0x74, 0x24, 0x18,
    0x57, 0x41, 0x54, 0x41, 0x55, 0x41, 0x56, 0x41, 0x57, 0x48, 0x81, 0xEC, 0xB0, 0x00, 0x00
};

unsigned char ptImgpValidateImageHash_9200[] = {
    0x48, 0x89, 0x5C, 0x24, 0x08, 0x48, 0x89, 0x74, 0x24, 0x10, 0x48, 0x89, 0x7C, 0x24, 0x18,
    0x55, 0x41, 0x54, 0x41, 0x55, 0x41, 0x56, 0x41, 0x57, 0x48, 0x8D, 0x6C, 0x24, 0x90
};

unsigned char ptImgpValidateImageHash_9600[] = {
    0x48, 0x89, 0x5C, 0x24, 0x10, 0x4C, 0x89, 0x4C, 0x24, 0x20, 0x48, 0x89, 0x4C, 0x24, 0x08, 0x55,
    0x56, 0x57, 0x41, 0x54, 0x41, 0x55, 0x41, 0x56, 0x41, 0x57, 0x48, 0x8D, 0x6C, 0x24, 0x80
};

unsigned char ptImgpValidateImageHash_10240[] = {
    0x48, 0x8B, 0xC4, 0x48, 0x89, 0x58, 0x20, 0x44, 0x89, 0x40, 0x18, 0x48, 0x89, 0x50, 0x10, 0x48,
    0x89, 0x48, 0x08, 0x55, 0x56, 0x57, 0x41, 0x54, 0x41, 0x55, 0x41, 0x56, 0x41, 0x57, 0x48, 0x8D,
    0xA8, 0x08, 0xFF, 0xFF
};

unsigned char ptImgpValidateImageHash_10586[] = {
    0x48, 0x8B, 0xC4, 0x48, 0x89, 0x58, 0x08, 0x44, 0x89, 0x40, 0x18, 0x48, 0x89, 0x50, 0x10, 0x55,
    0x56, 0x57, 0x41, 0x54, 0x41, 0x55, 0x41, 0x56, 0x41, 0x57, 0x48, 0x8D, 0xA8, 0xE8, 0xFE, 0xFF, 0xFF
};

unsigned char ptImgpValidateImageHash_14393[] = {
    0x48, 0x8B, 0xC4, 0x4C, 0x89, 0x48, 0x20, 0x44, 0x89, 0x40, 0x18, 0x48, 0x89, 0x50, 0x10, 0x48,
    0x89, 0x48, 0x08, 0x55, 0x53, 0x56, 0x57, 0x41, 0x54, 0x41, 0x55, 0x41, 0x56, 0x41, 0x57, 0x48,
    0x8D, 0xA8, 0x98, 0xFE, 0xFF, 0xFF
};

unsigned char ptImgpValidateImageHash_15063[] = {
    0x48, 0x8B, 0xC4, 0x4C, 0x89, 0x48, 0x20, 0x44, 0x89, 0x40, 0x18, 0x48, 0x89, 0x50, 0x10, 0x48,
    0x89, 0x48, 0x08, 0x55, 0x53, 0x56, 0x57, 0x41, 0x54, 0x41, 0x55, 0x41, 0x56, 0x41, 0x57, 0x48,
    0x8D, 0xA8, 0x78, 0xFE, 0xFF, 0xFF
};
